chore(release): cut v1.11.0 - #1050

Summary

Release cut for v1.11.0:

• pyproject.toml → 1.11.0
• CHANGELOG: [Unreleased] becomes [1.11.0] - 2026-07-11; adds the two entries produced during release testing (Pillow 12.3.0 security bump fix(security): force pillow >= 12.2.0 past moviepy's cap #1041, credential field-clearing fix fix: actually clear credential fields end to end (frontend payload + API null handling) #1046)

Release confidence (test plan executed)

• Backend suite 407 passed · frontend 85/85 + production build · ruff clean
• Smoke E2E: GO — 14/14 API, 7/7 UI (Playwright), zero console errors
• Targeted security-regression probes: 9/9 green after fixes (fix: title sort 500 and form-validation 500s in the sources API #1042)
• Docker image gate: fresh install 16/16 (migrations, in-image worker, nginx proxy) and upgrade v1.10.0 → new with data surviving migrations 16-18 12/12
• Dependabot: 6 alerts resolved (fix(security): force pillow >= 12.2.0 past moviepy's cap #1041)
• Manual pass (bucket C): providers, podcast with real TTS, visual tour — findings fixed in fix: actually clear credential fields end to end (frontend payload + API null handling) #1046/fix(frontend): keep the note editor dialog inside the viewport with long content #1047, backlog issues Podcast generation ignores the speaker_profile parameter #1044/source_insight records have no created/updated timestamps; API serializes them as the string "None" #1045

After merge: rebuild image, re-run the image harness against the final RC, make tag, make docker-push (no latest), manual verification of the pushed image, then make docker-push-latest + GitHub release.